ThreatFox: Aisuru IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific Indicators of Compromise (IOCs) linked to the Aisuru threat intelligence feed, which often signal early-stage reconnaissance or initial access attempts. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate potential compromises before they escalate into full-scale incidents, leveraging high-severity alerts to prioritize rapid response actions.

IOC Summary

Malware Family: Aisuru Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Aisuru
let malicious_ips = dynamic(["159.65.143.171", "149.28.145.14"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["159.65.143.171", "149.28.145.14"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Aisuru

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Aisuru IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Security Tool Internal Communication

  • Context: The organization’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, periodically queries the Aisuru threat intelligence feed to update its local reputation database. This generates network traffic matching the rule’s IOCs.
  • Filter/Exclusion: Exclude network traffic originating from the specific EDR management server IP addresses (e.g., 10.20.5.15) or filter out processes running under the service account of the security tool (e.g., svc-crowdstrike on Windows) when communicating with Aisuru’s known update endpoints.

• Scenario: Scheduled Threat Intelligence Ingestion Job

  • Context: The Security Operations Center runs a nightly automated job using PowerShell or Python scripts hosted on the SIEM ingestion server (e.g., Splunk Heavy Forwarder) to fetch and parse Aisuru’s daily IOC feed for enrichment. This scheduled task triggers the detection logic every morning at 02:00 UTC.
  • Filter/Exclusion: Create a time-based exclusion for the specific host running the ingestion script (e.g., SIEM-INGEST-01) between 01:30 and 03:00 UTC, or filter events where the process name matches the scheduled job executable (e.g., fetch_aisuru_iocs.ps1).

• Scenario: Admin Manual Verification of New Threats

  • Context: A Senior SOC Analyst manually investigates a new campaign and uses a browser (Google Chrome) on their workstation to access the Ais